larksuite/cli · error
official skills index exceeds %d bytes
Error message
official skills index exceeds %d bytes
What it means
FetchSkillsIndex reads the response body through an io.LimitReader capped at skillsIndexMaxBodySize. If the body is larger than the cap, the buffered output is discarded and this error is returned, protecting the CLI from unexpectedly huge or hostile index payloads.
Source
Thrown at internal/selfupdate/updater.go:322
if err != nil {
r.Err = err
return r
}
defer resp.Body.Close()
if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices {
r.Err = fmt.Errorf("official skills index returned HTTP %d", resp.StatusCode)
return r
}
limited := io.LimitReader(resp.Body, skillsIndexMaxBodySize+1)
if _, err := io.Copy(&r.Stdout, limited); err != nil {
r.Err = err
return r
}
if r.Stdout.Len() > skillsIndexMaxBodySize {
r.Stdout.Reset()
r.Err = fmt.Errorf("official skills index exceeds %d bytes", skillsIndexMaxBodySize)
return r
}
return r
}
func (u *Updater) ListGlobalSkills() *NpmResult {
return u.runSkillsListGlobal()
}
func (u *Updater) ListGlobalSkillsJSON() *NpmResult {
return u.runSkillsCommand("-y", "skills", "ls", "-g", "--json")
}
func (u *Updater) InstallSkills(source string, nameList []string) *NpmResult {
return u.runSkillsInstall(source, nameList)
}
func (u *Updater) InstallAllSkills(source string) *NpmResult {View on GitHub (pinned to 7fd6ef3c07)
Solutions
- Verify the source URL points at the actual skills index JSON, not a package tarball or HTML page
- Inspect what the endpoint returns (curl the URL) to see why the payload is oversized
- Fix a misbehaving mirror/proxy returning bloated or wrong content and retry
- If the official index legitimately grew past the cap, update the CLI to a version with a raised limit
Example fix
// before source := "https://registry.example.com/@larksuite/cli/-/cli-1.2.3.tgz" // wrong: tarball, not index res := updater.FetchSkillsIndex(source) // after source := "https://registry.example.com/skills/index.json" // the real index document res := updater.FetchSkillsIndex(source)
Defensive patterns
Strategy: validation
Validate before calling
resp, err := http.Get(indexURL)
if err == nil { b, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20)); if len(b) > skillsIndexMaxBodySize { /* URL is wrong or endpoint bloated */ } } Try / catch
res := updater.FetchSkillsIndex(source)
if res.Err != nil {
if strings.Contains(res.Err.Error(), "exceeds") && strings.Contains(res.Err.Error(), "bytes") {
// wrong URL or hostile payload: verify source points at index JSON
} else {
return res.Err
}
} Prevention
- Point the source at the index JSON document, never a tarball or HTML page
- curl the endpoint once to sanity-check content type and size
- Use trusted mirrors that return well-formed small index documents
- Keep the CLI updated so the size cap tracks the real index growth
When it happens
Trigger: Calling Updater.FetchSkillsIndex(source) when the HTTP response body exceeds skillsIndexMaxBodySize bytes — r.Stdout.Len() > skillsIndexMaxBodySize after the copy.
Common situations: Pointing the skills source at the wrong URL (e.g. a tarball or full package download instead of the JSON index); a mirror returning an HTML error page or directory listing; a corrupted/misbehaving proxy dumping large content.
Related errors
- invalid content range: end %d is outside total %d
- official skills index returned HTTP %d
- download request URL is missing
- Invalid column: {column!r}
- Invalid column index: {index}
AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04).
Data as JSON: /api/errors/0db09be86df025d9.
Report an issue: GitHub.